v3.15.1
Keras 3.15.1
Fixed 3
- Improve model loading efficiency by capturing the weight store into a local variable and enhance nested container detection in legacy files with isolated failure tracking
- Fix TraceContext errors when using JAX NNX backend with models like T5 that lack a build method by skipping trace-level checks during symbolic shape inference and handling Flax 0.12 API changes
- Resolve NotImplementedError boolean coercion changes in Python 3.14 and fix dimension filtering in shape utilities
Security 4
- Restrict unpickling when loading IMDB and Reuters datasets by replacing bare np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction
- Verify all intermediary H5 groups when navigating H5 files by manually resolving nested H5 group paths to verify group types at each step
- Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
- Restrict unpickling when loading CIFAR datasets by replacing bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler
Release Notes
Keras 3.15.1 is a patch release containing important security hardening, bug fixes, and Python 3.14 compatibility improvements.
Security Fixes
- Restrict unpickling when loading IMDB and Reuters datasets — Prevents insecure deserialization (CWE-502) by replacing bare
np.load(allow_pickle=True)with a restricted unpickler that only permits numpy array reconstruction. (#23047) by @LinZiyuu - Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal issues. (#23168) by @hertschuh
- Reject decompression-bomb members on the
.kerasasset extraction path — Adds per-member decompression-ratio checks before extracting.kerasarchives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu - Restrict unpickling when loading CIFAR datasets — Replaces bare
cPickle.loadin CIFAR-10/100 batch loading with the numpy-onlyRestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB
Bug Fixes
- Refactor
_load_stateto capture weight store while preserving Keras test passing — Improves model loading efficiency by capturing the weight store into a local variable, and enhances nested container detection in legacy files with isolated failure tracking. (#23226) by @buildwithsuhana - Fix TraceContext error for NNX backend — Fixes
TraceContexterrors when using JAX NNX backend with models like T5 that lack abuildmethod. Skips trace-level checks during symbolic shape inference and handles Flax 0.12 API changes. Fixes #23289. (#23326) by @divyashreepathihalli
Compatibility
- Fixes for Python 3.14 — Resolves
NotImplementedErrorboolean coercion changes in Python 3.14 and fixes dimension filtering in shape utilities. (#23259) by @hertschuh
Contributors
Thank you to all the contributors who made this release possible! 🎉
- @LinZiyuu — Security hardening for IMDB, Reuters, and
.kerasasset extraction (#23047, #23101) - @hertschuh — H5 group verification, Python 3.14 compatibility (#23168, #23259)
- @buildwithsuhana — Model loading refactor (#23226)
- @SABITHSAHEB — CIFAR dataset pickle restriction (#23252)
- @divyashreepathihalli — NNX backend TraceContext fix (#23326)
Full Changelog: https://github.com/keras-team/keras/compare/v3.15.0...v3.15.1